In January 2020, the European Commission endorsed the Toolbox of mitigating measures agreed by the Member States of the European Union to address security risks related to the rollout of 5G. The protection of national security, and cybersecurity in particular, are unquestionably legitimate objectives. However, since protecting these interests may contravene ordinarily applicable laws and principles, EU and international law provide for exceptions to enable the adoption of such security-related measures. These are not open-ended instruments, though, and must be applied subject to essential safeguards.

Certain Toolbox measures could raise legal risks, depending on their actual implementation by Member States. The present White Paper focuses on three Strategic measures ("SM") presented in the Toolbox, as their implementation could raise a number of legal concerns. Specifically, these SM relate to: (i) expanding the role of national authorities (SM01), which may lead to additional and questionable authorization regimes; (ii) screening for high-risk suppliers and imposing restrictions on the use of equipment from such suppliers (SM03), potentially resulting in the outright and unwarranted exclusion of certain suppliers; and (iii) multi-vendor strategies (SM05), which cannot be interpreted as a market share cap that would unjustifiably reduce the number of suppliers on the market.